MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243
SHA3-384 hash: a1981fe5c44f6f7d83307440f4c11ba9e9571cafd8e687e82f712556398db02e3e4e67a36f7bf34ce933a3be515de015
SHA1 hash: cba997f9290dd8f8d0a6d0e5c538834fbf195e8b
MD5 hash: 182b0a54d9e36db914beb8aa2cbe1d3b
humanhash: bravo-lion-failed-three
File name:bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243
Download: download sample
Signature IcedID
Create hunting rule
File size:146'432 bytes
First seen:2020-11-15 22:50:22 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3097b1c5bba2e716be269c55c1f71681 (9 x IcedID)
ssdeep 3072:lufEDAMPx16H6WFD/P0J+fS+u8L3lhiJo7A:lufcA8RWFQgKSq8A
Threatray 4 similar samples on MalwareBazaar
TLSH 32E39D023290D076E9A742319864DF915B7ABD615F718E9733C46A5FDE322D08E32BE3
Reporter seifreed
Tags:IcedID

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/539225
Signature
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243/
Threat name:
Win32.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2020-11-15 22:52:09 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xw6dqugrac2rofdkec4jnzs6wksbcbdkauqledpttniy47cfcjbq._file
Verdict:
unknown
Similar samples:
2934ee71acf2ecf4b46532bdc0df7d12de3d2033a2d0a5ae4f42da5b0e571f92
IcedID
6a70d723e3137cbc6193ebe8bcf7a7df78fa83d9852a0ec8e172ba137ef6fd7a
IcedID
ca8a6c634895059c5229d085b62814380d99df0abd699dcf2dbd7014f4a31714
IcedID
fe47d6df1dbba98481434048616e085c98555a8537964636aa54e9f30a8e38a5
IcedID
Result
Malware family:
icedid
Create hunting rule
Score:
  10/10
Tags:
family:icedid banker trojan
Link:
https://tria.ge/reports/201115-3c649h57da/
Behaviour
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
IcedID Core Payload
IcedID, BokBot
Unpacked files
SH256 hash:
bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243
MD5 hash:
182b0a54d9e36db914beb8aa2cbe1d3b
SHA1 hash:
cba997f9290dd8f8d0a6d0e5c538834fbf195e8b
Link:
https://www.unpac.me/results/7c02ee2e-dcc8-440b-9b38-2a1e332c0eba/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bdbc3850d100b517146a20b896e65eb2a411046a0520b20df39b518e7c451243

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_banker_iceid_ldr1
Create hunting rule
Author:@VK_Intel
Description:Detects IcedId/BokBot png loader (unpacked)
Reference:twitter

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments